Isaca CDPSE Exam - Topic 10 Question 73 Discussion

Actual exam question for Isaca's CDPSE exam

Question #: 73
Topic #: 10

[All CDPSE Questions]

Which of the following BEST represents privacy threat modeling methodology?

AMitigating inherent risks and threats associated with privacy control weaknesses

BSystematically eliciting and mitigating privacy threats in a software architecture

CReliably estimating a threat actor's ability to exploit privacy vulnerabilities

DReplicating privacy scenarios that reflect representative software usage

Show Suggested Answer

Suggested Answer: B

Privacy threat modeling is a methodology for identifying and mitigating privacy threats in a software architecture. It helps to ensure that privacy is considered in the design and development of software systems, and that privacy risks are minimized or eliminated. Privacy threat modeling typically involves the following steps: defining the scope and context of the system, identifying the data flows and data elements, identifying the privacy threats and their sources, assessing the impact and likelihood of the threats, and applying appropriate countermeasures to mitigate the threats.Reference:: CDPSE Review Manual (Digital Version), page 97

by Levi at Nov 22, 2025, 10:35 AM

Limited Time Offer

25%

Off

Get Premium CDPSE Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Aja

1 month ago

Overall, B stands out. It’s about the architecture and threats together.

upvoted 0 times

...

Domonique

2 months ago

D is relevant, but it doesn’t capture the methodology aspect well.

upvoted 0 times

...

Candra

2 months ago

C is interesting, but it focuses too much on threat actors.

upvoted 0 times

...

Dino

2 months ago

A seems good too, but it’s more about risks than methodology.

upvoted 0 times

...

German

2 months ago

Surprised that D isn't getting more love!

upvoted 0 times

...

Vallie

2 months ago

A is too vague for my liking.

upvoted 0 times

...

Lenna

2 months ago

I don't know, C sounds pretty solid too.

upvoted 0 times

...

Douglass

3 months ago

B is definitely the best choice here.

upvoted 0 times

...

Sylvie

3 months ago

B) Systematically eliciting and mitigating privacy threats in a software architecture. Sounds like a job for the privacy police!

upvoted 0 times

...

Kimbery

3 months ago

A) Mitigating inherent risks and threats associated with privacy control weaknesses. Boring, but it gets the job done.

upvoted 0 times

...

Ming

4 months ago

D) Replicating privacy scenarios that reflect representative software usage. Sounds like a fun game of "Guess the Privacy Breach!"

upvoted 0 times

...

Yuette

4 months ago

C) Reliably estimating a threat actor's ability to exploit privacy vulnerabilities. Gotta love those sneaky hackers!

upvoted 0 times

...

Vivienne

4 months ago

B) Systematically eliciting and mitigating privacy threats in a software architecture. That's the way to go!

upvoted 0 times

...

Heike

4 months ago

D sounds interesting, but I wonder if replicating scenarios is really the best way to model threats. I lean towards B for a more systematic approach.

upvoted 0 times

...

Annita

4 months ago

I'm not entirely sure, but I feel like A might be too broad. It seems more focused on risks rather than a specific methodology.

upvoted 0 times

...

Lashandra

4 months ago

I think I remember that privacy threat modeling is about identifying and mitigating threats, so maybe B is the right choice?

upvoted 0 times

...

Ronald

5 months ago

B seems like the clear winner to me. Systematically identifying and addressing privacy risks is the heart of an effective threat modeling process. The other options are more narrow in scope.

upvoted 0 times

...

Coleen

5 months ago

I'm a little confused by the question. Are we looking for the definition of privacy threat modeling, or the best overall methodology? I'm leaning towards B, but I want to make sure I fully understand what the question is asking.

upvoted 0 times

...

Lynelle

5 months ago

Definitely going with B. Proactively considering privacy threats during architecture and design is the most comprehensive way to approach this. The other options feel more reactive or incomplete.

upvoted 0 times

...

Jess

5 months ago

I agree, B feels comprehensive. Eliciting threats is key.

upvoted 0 times

...

Ilda

5 months ago

I think B is the best choice. It covers the systematic approach.

upvoted 0 times

...

Tricia

6 months ago

I practiced a question similar to this, and I think C could be relevant since understanding threat actors is important, but it might not cover the whole methodology.

upvoted 0 times

...

Malcolm

6 months ago

B covers the systematic approach we need.

upvoted 0 times

...

Robt

6 months ago

Hmm, I'm a bit unsure about this one. I was thinking C might be the right answer, since accurately assessing the threat actor's capabilities is crucial for effective privacy risk mitigation.

upvoted 0 times

...

Arminda

6 months ago

I think B is the best answer here. Systematically identifying and addressing privacy threats in the software design seems like the core of a good privacy threat modeling approach.

upvoted 0 times